crypto: support OpenSSL STORE private keys

[panva]

Note

Looking for reviews from folk knowledgeable of OpenSSL STORE providers.

Allow crypto.createPrivateKey() and private-key consumers such as crypto.sign() to load private keys from WHATWG URL objects via OpenSSL STORE.

This supports both direct URL input:

import { createPrivateKey } from 'node:crypto';

const key = createPrivateKey(new URL('file:///path/to/private-key.pem'));

and object input with optional STORE credentials and OpenSSL property query
metadata:

import { createPrivateKey, sign } from 'node:crypto';

const key = createPrivateKey({
  key: new URL('pkcs11:token=node;object=signing-key;type=private'),
  passphrase: process.env.PKCS11_PIN,
  properties: 'provider=pkcs11',
});

const signature = sign('sha256', Buffer.from('payload'), key);

The properties option is passed to OpenSSL as the property query used when fetching the STORE loader. It is not appended to the URL and is distinct from provider-specific URI parameters such as PKCS#11 token or object attributes.

Permission model

STORE loading is gated by a new crypto.store permission capability. When the Permission Model is enabled, attempts to load private keys from STORE URLs require --allow-crypto-store; otherwise ERR_ACCESS_DENIED is thrown.

$ node --permission --allow-crypto-store app.mjs

The permission is exposed through the runtime permission APIs:

process.permission.has('crypto.store'); // true
process.permission.drop('crypto.store');
process.permission.has('crypto.store'); // false

For file: STORE URLs, the existing file-system permission still applies as well: Node checks fs.read for the resolved file path before calling OpenSSL.

Passphrases and errors

The passphrase option is forwarded to OpenSSL's STORE UI callback and serves as the passphrase or PIN for encrypted or token-protected private keys.

If OpenSSL requests a passphrase and none was provided, Node throws ERR_MISSING_PASSPHRASE, matching the existing encrypted private-key import behavior. Incorrect passphrases continue to surface as OpenSSL errors.

[nodejs-github-bot]

Review requested:

• @nodejs/actions
• @nodejs/config
• @nodejs/crypto
• @nodejs/gyp
• @nodejs/security-wg

I changed the feature shape quite a bit. Dismissing a stale review.